lorax

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:54 PM UTC
• Version: 1.0.1

Overview

This documentation-only Lorax skill is not malicious, but its examples include unsafe OS-image defaults that could create a known root password, omit the firewall, or wipe data if copied directly.

Review and edit the examples before use. Do not build deployable images with the sample root password, keep or replace firewall protection intentionally, scope any disk-wipe Kickstart directives to disposable targets, and verify cleanup paths before running recursive deletion commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:286

Finding

Kickstart Example Creates a Predictable Plaintext Root Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 286
Vulnerability Type: Hardcoded predictable privileged credential
Risk Level: High

Complete Code Snippet:

kickstart

# Root password
rootpw --plaintext password

Technical Analysis

The supplied Kickstart configuration sets the root password to the literal value password and explicitly stores it in plaintext. If a user copies this example, every image produced from it will have the same publicly documented root credential.

In addition to creating a predictable privileged credential, the plaintext value can remain visible in the Kickstart file, source control, build logs, build artifacts, or installation media. The surrounding documentation does not require the password to be replaced before building an image.

This is an insecure image configuration rather than evidence that the package itself accesses an existing credential.

Attack Path

1. An administrator copies the documented Kickstart example.
2. The administrator builds and deploys an image without replacing or disabling the example root password.
3. The deployed system permits root authentication through a console, SSH configuration, recovery environment, or another authentication service.
4. An attacker uses the username root and the documented password password.
5. If authentication is permitted, the attacker obtains full administrative access to the affected system.

Impact Assessment

Successful exploitation grants root privileges on every deployed host built from the unchanged configuration. Root access permits reading or modifying all local data, changing security settings, installing persistent software, extracting locally available credentials, and using the compromised host to attack connected systems.

The affected scope depends on how many images were generated from the example and whether direct root authentication is reachable. The credential's publi ...[truncated 87 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the example with rootpw --lock when direct root authentication is unnecessary.
• If a root password is required, use rootpw --iscrypted with a unique, strongly salted password hash.
• Inject the hash from a protected build-time secret rather than committing it to the Kickstart file.
• Add an unprivileged administrative account and grant narrowly controlled sudo access.
• Disable remote root login in SSH and other remotely accessible authentication services.
• Clearly identify all credential values as nonfunctional placeholders and make image validation fail if a known example credential remains.
• Scan generated images and build artifacts for default credentials before release.
• Rotate credentials and rebuild any image previously created from the unchanged example.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:101

Finding

Image-Build Examples Explicitly Remove the Host Firewall

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 101–113 and 202–213
Vulnerability Type: Insecure generated-system configuration
Risk Level: Medium

Complete Code Snippets:

bash

# Full parameter example
lorax \
  -p "Fedora" \
  -v "39" \
  -r "39" \
  -o "/var/tmp/lorax" \
  --project "Fedora Project" \
  --release "Fedora 39" \
  --variant "Server" \
  --bugurl "https://bugzilla.redhat.com" \
  --isfinal \
  --installpkgs "fedora-release,systemd" \
  --excludepkgs "firewalld" \
  --macboot \
  /path/to/repo

bash

# Install specific packages
lorax \
  -p "Fedora" \
  -v "39" \
  -r "39" \
  -o "/var/tmp/lorax" \
  --installpkgs "fedora-release,systemd,grub2,kernel" \
  --installpkgs "gnome-desktop,firefox" \
  --excludepkgs "firewalld,postfix" \
  /path/to/repo

Technical Analysis

Two general-purpose Lorax examples explicitly exclude firewalld, Fedora and RHEL's standard host-firewall management package. The examples do not install or configure an equivalent host-level packet-filtering mechanism.

Removing the firewall does not independently create a remotely exploitable service. However, it eliminates a defense-in-depth boundary that would otherwise restrict access to services installed in, or later added to, the generated image. This is particularly risky for server, desktop, and cloud images deployed on untrusted or broadly reachable networks.

The examples also conflict with the document's later recommendation to configure a firewall, making it more likely that users will produce images without the recommended protection.

Attack Path

1. An administrator copies one of the documented Lorax commands.
2. Lorax generates an image with firewalld excluded.
3. The image is deployed without an equivalent nftables, iptables, cloud firewall, or network access-control policy.
4. A service in the base image, or one installed later, l ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

• Remove firewalld from both --excludepkgs examples.
• Install and enable firewalld, with only explicitly required services and ports permitted.
• If another firewall implementation is intended, install and configure it in the image and explain the compensating control next to the example.
• Apply a default-deny inbound policy suitable for the image's deployment environment.
• Combine host-level filtering with cloud security groups or external network access-control lists rather than treating them as substitutes by default.
• Add automated image tests that verify a firewall implementation is installed, enabled, and enforcing the intended policy.
• Document all expected listening services and validate the generated image with a port scan before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Kickstart example hard-codes a plaintext root password (rootpw --plaintext password) in documentation without any warning. This normalizes insecure practice, may lead users to build images with a known default credential, and exposes the password anywhere the file, shell history, or generated image configuration is stored.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although not equivalent to rm -rf /, the documented wildcard deletion command can still cause substantial data loss if the path is mistyped, symlinked unexpectedly, or copied into an altered environment. Because this is a skill users may follow directly, an unguarded recursive delete in troubleshooting guidance is risky enough to treat as a documentation vulnerability.

Content

Scanner excerpt · SKILL.md (reported line 488)May include surrounding context.

清理临时文件

Clean temp files

rm -rf /var/tmp/lorax/*

text

### 启动失败 | Boot Failed

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although not equivalent to rm -rf /, the documented wildcard deletion command can still cause substantial data loss if the path is mistyped, symlinked unexpectedly, or copied into an altered environment. Because this is a skill users may follow directly, an unguarded recursive delete in troubleshooting guidance is risky enough to treat as a documentation vulnerability.

Content

Scanner excerpt · SKILL.md (reported line 488)May include surrounding context.

清理临时文件

Clean temp files

rm -rf /var/tmp/lorax/*

text

### 启动失败 | Boot Failed

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Kickstart sample uses clearpart --all --initlabel, which wipes existing partition tables and can destroy all disk data if applied to the wrong target. In an image-building skill, destructive partitioning is sometimes legitimate, but presenting it without a warning or safer scoping increases the risk of accidental data loss.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md

# 安装基本包
# Install base packages
installpkg fedora-release
installpkg systemd
installpkg kernel
installpkg grub2

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

md

# 检查依赖
# Check dependencies
dnf deplist lorax

# 清理临时文件
# Clean temp files

Static analysis

No suspicious patterns detected.